Summary

• AuditDotfiles skill (skills/AuditDotfiles/) — captures the migration-time secret audit workflow: scan a dotfiles tree with gitleaks (redacted), aggregate findings by top-level directory and rule, and surgically filter flagged lines from shell-history files so the rest can be imported into atuin. Composes with SecretScan in forge-core (commit-time prevention).
• scripts/audit-dotfiles.sh inside the skill dir — executable end-to-end pipeline. Uses gitleaks + yq (mikefarah's) + awk + sed. Exits 0 when clean, 1 when leaks found.
• forge-cli 0.3 compatibility fix in .githooks/pre-commit and Makefile — drops the positional . from forge validate and forge install (now flag-only --source <DIR> with default .). Without this, the pre-commit hook fails on every commit.

The SKILL.md notes the key constraint behind the design: never bulk-delete a flagged history file — years of useful recall live in those lines; surgical line-filtering preserves the rest. Also: don't pre-split && chains before atuin import (atuin's fulltext search matches against the whole command).

Test plan

• Pre-commit hook fires on git commit and validates (this PR's commits are signed and the hook ran)
• audit-dotfiles.sh <path> dependency check exits 2 when gitleaks / yq / awk missing
• audit-dotfiles.sh <path> exits 0 with "no leaks found" message on a clean directory (verified on ~/Downloads/dotfiles, a public xero-fork)
• audit-dotfiles.sh <path> exits 1 with per-dir-per-rule aggregation on ~/Downloads/dotfiles-private (18 leaks across 5 rule types)
• audit-dotfiles.sh <path> --filter-history emits <history>.clean next to the flagged file with leaked lines stripped
• After merge: make install deploys the skill via forge-cli 0.3.1 end-to-end